@bogyie/opencode-kiro-plugin 0.3.11 → 0.3.12

package/README.md

@@ -40,7 +40,7 @@ The plugin resolves credentials in this order:
 
 OpenCode startup does not start Kiro login or model discovery. The plugin injects `provider.kiro` with an `auto` placeholder model so Kiro appears in OpenCode's provider connector. Model discovery runs only when you explicitly call the `kiro_refresh_models` plugin tool; if discovery succeeds, later model-list requests use the latest in-memory cache. If discovery fails, the previous cache remains in use.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. When `login.identityProvider` and `login.region` are configured, use `Kiro device login (configured)` to start login without re-entering those values. Use `Kiro device login (custom)` only when you need to override the Start URL, OIDC region, or profile ARN for that login. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow from the configured `login` options and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
@@ -62,7 +62,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
+For IAM Identity Center, configure `login.identityProvider` and `login.region` in plugin options so they are passed to `kiro-cli login --use-device-flow`.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory model cache. Secrets are redacted in diagnostics.
 

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
+import { credentialFromKiroDeviceAuthKey, detectAuth, isKiroDeviceAuthKey, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -53,10 +53,6 @@ function bearerToken(init) {
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
-function inputString(inputs, key) {
-    const value = inputs?.[key];
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
 export function effectiveBackend(options, accessToken) {
     const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
@@ -164,36 +160,26 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
-        const authorizeDeviceLogin = async (inputs) => {
-            const startUrl = inputString(inputs, "startUrl") ?? options.login.identityProvider;
-            const idcRegion = inputString(inputs, "idcRegion") ?? options.login.region ?? "us-east-1";
-            const profileArn = inputString(inputs, "profileArn") ?? options.profileArn;
-            const authorization = await authorizeKiroDevice({
-                region: idcRegion,
-                ...(startUrl ? { identityProvider: startUrl } : {}),
+        const authorizeCliDeviceLogin = async () => {
+            const session = startKiroCliLoginOnce({
+                ...options.login,
+                useDeviceFlow: true,
             });
-            const url = startUrl ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode) : authorization.verificationUrlComplete;
+            await session.waitForPrompt(options.requestTimeoutMs);
             return {
-                url,
-                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
+                url: session.url,
+                instructions: session.instructions,
                 method: "auto",
                 callback: async () => {
-                    const credential = await pollKiroDeviceToken(authorization, {
-                        region: options.region,
-                        ...(profileArn ? { profileArn } : {}),
-                    });
-                    const key = encodeKiroDeviceAuthKey(credential);
+                    const authenticated = await session.waitForAuth();
+                    if (!authenticated)
+                        return { type: "failed" };
+                    await refreshModels(true).catch(() => []);
                     return {
                         type: "success",
-                        key,
-                        access: key,
-                        refresh: credential.refreshToken,
-                        expires: credential.expiresAt,
+                        key: "kiro-plugin-local-transport",
                         metadata: {
-                            source: "kiro-device-auth",
-                            region: credential.region,
-                            oidcRegion: credential.oidcRegion,
-                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+                            source: "kiro-cli-device-flow",
                         },
                     };
                 },
@@ -225,39 +211,8 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: options.login.identityProvider ? "Kiro device login (configured)" : "Kiro device login",
-                        authorize: async () => authorizeDeviceLogin(),
-                    },
-                    {
-                        type: "oauth",
-                        label: "Kiro device login (custom)",
-                        prompts: [
-                            {
-                                type: "text",
-                                key: "startUrl",
-                                message: options.login.identityProvider
-                                    ? `IAM Identity Center Start URL (current: ${options.login.identityProvider}, leave blank to keep)`
-                                    : "IAM Identity Center Start URL (leave blank for AWS Builder ID)",
-                                placeholder: "https://your-company.awsapps.com/start",
-                            },
-                            {
-                                type: "text",
-                                key: "idcRegion",
-                                message: options.login.region && options.login.region !== "us-east-1"
-                                    ? `IAM Identity Center region (current: ${options.login.region}, leave blank to keep)`
-                                    : "IAM Identity Center region (leave blank for us-east-1)",
-                                placeholder: "us-east-1",
-                            },
-                            {
-                                type: "text",
-                                key: "profileArn",
-                                message: options.profileArn
-                                    ? `Profile ARN (current: ${options.profileArn}, leave blank to keep)`
-                                    : "Profile ARN (optional, improves region/profile routing for IAM Identity Center)",
-                                placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
-                            },
-                        ],
-                        authorize: async (inputs) => authorizeDeviceLogin(inputs),
+                        label: "Kiro device login",
+                        authorize: async () => authorizeCliDeviceLogin(),
                     },
                     {
                         type: "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",